CVE-2024-48949 — Improper Verification of Cryptographic Signature in Elliptic
Severity
9.1CRITICALNVD
EPSS
0.3%
top 47.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 10
Latest updateNov 18
Description
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2
Affected Packages7 packages
Patches
🔴Vulnerability Details
3📋Vendor Advisories
3Microsoft▶
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.↗2024-10-08
Debian▶
CVE-2024-48949: node-elliptic - The verify function in lib/elliptic/eddsa/index.js in the Elliptic package befor...↗2024